CVEvulnerability

CVE-2026-119194

7.5 HIGH EPSS 0.43% Published 2026-10-29 Modified 2026-11-03 Official page ↗

Exploitation and prioritisation

EPSS
0.43% chance of exploitation in the next 30 days · in the top 63.2% of all CVEs (2026-11-03)
CISA SSVC: exploitation
poc
CISA SSVC: automatable
yes
CISA SSVC: technical impact
partial
EU Vulnerability Database
EUVD-2026-113350

Affected packages

EcosystemPackageVulnerableFixed inAdvisory
PyPIpyasn1>= 0.3.3, < 0.6.50.6.5GHSA-fm9c-5rcf-2q5p
Status
Awaiting Analysis
Published
2026-10-29
Last modified
2026-11-03
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-407

Description

pyasn1 is a generic ASN.1 library for Python. From 0.3.3 until 0.6.5, schemaless container decoding stores every decoded component's TagSet in a growing set even though only one-versus-multiple tag types must be distinguished. Attacker-controlled BER, CER, or DER input contains many distinct long tag IDs whose TagSet hashes collide. Each later set insertion compares against an increasing number of earlier colliding tags in ConstructedPayloadDecoderBase._decodeComponentsSchemaless, producing quadratic CPU work while decoded values and order remain valid. Repeated inputs can exhaust decoder CPU and reduce service availability. This issue is fixed in version 0.6.5.

Related

Weakness · CWE (1)

  • CWE-407 Inefficient Algorithmic Complexity weakness

Referenced by GitHub Advisory · alias (1)

  • GHSA-fm9c-5rcf-2q5p pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding advisory · PyPI

References